Skip Headers
Oracle® Exalogic Elastic Cloud Enterprise Deployment Guide for Oracle Identity and Access Management
Release EL X2-2 and EL X3-2

E35832-02
Go to Documentation Home
Home
Go to Book List
Book List
Go to Table of Contents
Contents
Go to Index
Index
Go to Feedback page
Contact Us

Go to previous page
Previous
Go to next page
Next
PDF · Mobi · ePub

8 Installing and Configuring Oracle Unified Directory

This chapter describes how to install and configure Oracle Unified Directory (OUD) in the enterprise deployment.

This chapter includes the following topics:

8.1 Overview of Installing and Configuring Oracle Unified Directory

Oracle Unified Directory is a required component in the Identity Management enterprise topologies. You use it as the Identity Store, that is, for storing information about users and groups.

In this chapter, you configure two instances of Oracle Unified Directory by using Oracle Unified Directory configuration assistant.

8.2 Prerequisites for Configuring Oracle Unified Directory Instances

Before configuring the Oracle Unified Directory Instances on IDMHOST1 and IDMHOST2 ensure that the following tasks have been performed:

Note:

Be sure to verify you have obtained all required patches. For more info, see Section 2.5.3, "Applying Patches and Workarounds."

8.3 Installing Oracle Unified Directory

Perform these steps to install Oracle Unified Directory on IDMHOST1 and IDMHOST2.

Ensure that the system, patch, kernel and other requirements are met. These are listed in Oracle Fusion Middleware Installation Guide for Oracle Identity Management in the Oracle Fusion Middleware documentation library for the platform and version you are using.

Install the JDK as described in Section 9.2.1.1, "Installing JRockit." To start the Oracle Fusion Middleware 11g Oracle Identity Management Installer, change directory to Disk 1 of the installation media and enter the command:

./runInstaller

Then proceed as follows:

On the Specify Inventory Directory screen, do the following:

Follow the instructions on screen to execute createCentralInventory.sh as root.

  1. On the Welcome screen, click Next.

  2. On the Install Software Updates screen, choose whether to skip updates, check with Oracle Support for updates, or search for updates locally.

    Click Next.

  3. On the Prerequisite Checks screen, verify that the checks complete successfully, then click Next.

  4. On the specify Installation Screen Enter:

    • OUD Base Location Home: IAM_MW_HOME

    • Oracle Home Directory: oud

    Click Next.

  5. On the installation Summary Screen click Install.

  6. On the Installation Progress Screen click Next.

  7. On the installation complete Screen click Finish.

8.4 Configuring the Oracle Unified Directory Instances

Follow these steps to configure Oracle Unified Directory components in the application tier on IDMHOST1 and IDMHOST2. During the configuration you will also configure Oracle Unified Directory replication servers.

This section contains the following topics:

8.4.1 Configuring Oracle Unified Directory on IDMHOST1

Use the Oracle Unified Directory Configuration Assistant to configure Oracle Unified Directory.

Ensure that ports 1389 (LDAP_DIR_PORT), 1636 (LDAP_DIR_SSL_PORT), 4444 (LDAP_DIR_ADMIN_PORT), and 8989 (LDAP_DIR_REPL_PORT) are not in use by any service on the computer by issuing these commands for both IDMHOST1 and IDMHOST2. If a port is not in use, no output is returned from the command.

To insure that the ports are open, run the following command:

netstat -an | grep "1389"

If the ports are in use (that is, if the command returns output identifying either port), free the port.

  1. Set the environment variable JAVA_HOME

  2. Set the environment variable INSTANCE_NAME to:

    OUD_ORACLE_INSTANCE
    

    For example:

    ../../../../u02/private/oracle/config/instances/oud2
    

    Note:

    The tool creates the instance home relative to the OUD_ORACLE_HOME, so you must include previous directories to get the instance created in OUD_ORACLE_INSTANCE.

  3. Change Directory to OUD_ORACLE_HOME.

  4. Start the Oracle Unified Directory configuration assistant by executing the command:

    ./oud-setup
    
  5. On the Welcome screen, click Next.

  6. On the Server Settings screen, enter:

    • Host Name: The name of the host where Oracle Unified Directory is running, for example: IDMHOST1.mycompany.com

    • LDAP Listener Port: 1389 (LDAP_DIR_REPL_PORT)

    • Administration Connector Port: 4444 (LDAP_DIR_ADMIN_PORT)

    • LDAP Secure Access: Click Configure

    • In the Security Options page, enter:

      • SSL Access: Selected.

      • Enable SSL on Port: 1636 (LDAP_DIR_SSL_PORT)

      • Certificate: Generate Self Signed Certificate OR provide details of your own certificate.

      • Click OK

    • Root User DN: Enter an administrative user for example cn=oudadmin

    • Password: Enter the password you wish to assign to the ouadmin user.

    • Password (Confirm): Repeat the password.

    • Click Next.

  7. On the Topology Options screen:

    • Select: This server will be part of a replication topology

    • Enter: Replication Port: 8989

    • Select: Configure As Secure, if you wish replication traffic to by encrypted.

    • There is already a server in the topology. Leave it deselected.

    Click Next.

  8. On the Directory Data screen, enter:

    • Directory Base DN: dc=mycompany,dc=com

    • Directory Data: Only create base entry

    Click Next.

  9. On the Oracle Components Integration screen, click Next.

  10. On the Runtime Options screen, click Next.

  11. On the Review screen, verify that the information displayed is correct and click Finish.

  12. On the Finished screen, click Close.

8.4.2 Validating Oracle Unified Directory on IDMHOST1

After configuration, you can validate that Oracle Unified Directory is working by performing a simple search. To do this issue the following command:

OUD_ORACLE_INSTANCE/OUD/bin/ldapsearch -h IDMHOST1.mycompany.com -p 1389 -D cn=oudadmin -b "" -s base "(objectclass=*)" supportedControl

If Oracle Unified Directory is working correctly, you will see a list supportedControl entries returned.

8.4.3 Configuring an Additional Oracle Unified Directory Instance on IDMHOST2

Use the Oracle Unified Directory Configuration Assistant to configure Oracle Unified Directory.

Ensure that ports 1389 (LDAP_DIR_PORT), 1636 (LDAP_DIR_SSL_PORT), 4444 (LDAP_DIR_ADMIN_PORT), and 8989 (LDAP_DIR_REPL_PORT) are not in use by any service on the computer by issuing these commands for both IDMHOST1 and IDMHOST2. If a port is not in use, no output is returned from the command.

To insure that the ports are open, run the following command:

netstat -an | grep "1389"

If the ports are in use (that is, if the command returns output identifying either port), free the port.

  1. Set the environment variable JAVA_HOME

  2. Set the environment variable INSTANCE_NAME to:

    OUD_ORACLE_INSTANCE
    

    For example:

    ../../../../u02/private/oracle/config/instances/oud2
    

    Note:

    The tool creates the instance home relative to the OUD_ORACLE_HOME, so you must include previous directories to get the instance created in OUD_ORACLE_INSTANCE.

  3. Change Directory to OUD_ORACLE_HOME.

  4. Start the Oracle Unified Directory configuration assistant by executing the command:

    ./oud-setup
    
  5. On the Welcome screen, click Next.

  6. On the Server Settings screen, enter:

    • Host Name: The name of the host where Oracle Unified Directory is running, for example: IDMHOST2

    • LDAP Listener Port: 1389 (LDAP_DIR_PORT)

    • Administration Connector Port: 4444 (LDAP_DIR_ADMIN_PORT)

    • LDAP Secure Access

      • Click Configure

      • Select SSL Access

      • Enable SSL on Port: 1636 (LDAP_DIR_SSL_PORT)

      • Certificate: Generate Self Signed Certificate OR provide details of your own certificate.

      • Click OK

    • Root User DN: Enter an administrative user for example cn=oudadmin

    • Password: Enter the password you wish to assign to the ouadmin user.

    • Password (Confirm): Repeat the password.

    • Click Next.

  7. On the Topology Options screen, enter

    • This server will be part of a replication topology

    • Replication Port: 8989 (LDAP_DIR_REPL_PORT)

    • Select Configure As Secure, if you wish replication traffic to be encrypted.

    • There is already a server in the topology: Selected.

      Enter the following:

      • Host Name: The name of an existing Oracle Unified Directory server host, for example: IDMHOST1.mycompany.com

      • Administrator Connector Port: 4444 (LDAP_DIR_ADMIN_PORT)

      • Admin User: Name of the Oracle Unified Directory admin user on IDMHOST1, for example: cn=oudadmin

      • Admin Password: Administrator password.

      Click Next.

      If you see a certificate Not Trusted Dialogue, it is because you are using self signed certificates. Click Accept Permanently.

    Click Next.

  8. On The Create Global Administrator screen enter:

    • Global Administrator ID: The name of an account you want to use for managing Oracle Unified Directory replication, for example: oudmanager

    • Global Administrator Password / Confirmation: Enter a password for this account.

    Click Next.

  9. On the Data Replication Screen. select dc=mycompany.com and click Next.

  10. On the Oracle Components Integration screen, click Next.

  11. On the Runtime Options Screen click Next.

  12. On the Review Screen, check that the information displayed is correct and click Finish.

  13. On the Finished screen, click Close.

8.4.4 Enable Oracle Unified Directory Assured Replication

Ensure that data read from every Oracle Unified Directory instance is current. You do this by enabling Oracle Unified Directory Assured Replication in Safe Read Mode, as follows:

  1. On IDMHOST1, issue the following command:

    OUD_ORACLE_INSTANCE/OUD/bin/dsconfig -h IDMHOST1 -p 4444 -D "cn=oudadmin" -j ./password_file -n \
    set-replication-domain-prop \
    --provider-name "Multimaster Synchronization" \
    --domain-name "dc=mycompany,dc=com" \
    --advanced \
    --set assured-type:safe-read \
    --trustAll
    
  2. Confirm that the operation has been successful by issuing the command:

    OUD_ORACLE_INSTANCE/OUD/bin/dsconfig -h IDMHOST1 -p 4444 -D "cn=oudadmin" -j ./password_file -n \
    get-replication-domain-prop \
    --provider-name "Multimaster Synchronization" \
    --domain-name "dc=mycompany,dc=com" \
    --advanced \
    --property assured-type --property assured-timeout --property group-id \
    --trustAll
    

    Note:

    password_file is a file that contains the OUD administrator password.

    If Safe Mode is enabled, the output looks similar to this:

    Property        : Value(s)
    ----------------:----------
    assured-timeout : 2 s
    assured-type    : safe-read
    group-id        : 1
    
  3. Repeat steps 1-2 for each Oracle Unified Directory instance, for example: IDMHOST2.

8.4.5 Relaxing Oracle Unified Directory Object Creation Restrictions

Oracle Identity Management requires that a number of object classes be created in Oracle Unified Directory. You must perform the following step so that Oracle Unified Directory allows creation of the needed object classes.

Execute the following command on each Oracle Unified Directory instance:

OUD_ORACLE_INSTANCE/OUD/dsconfig -h IDMHOST1 -p 4444 -D "cn=oudadmin" -j ./password_file -n \
         set-global-configuration-prop \
         --set single-structural-objectclass-behavior:warn \
         -h IDMHOST1 -p 4444 -D "cn=oudadmin" -j ./password_file -n \
         --trustAll 

Repeat the command for each Oracle Unified Directory instance, for example: IDMHOST2.

8.4.6 Validating Oracle Unified Directory on IDMHOST2

After configuration you can validate that Oracle Unified Directory is working by performing a simple search. To do this issue the following command:

OUD_ORACLE_INSTANCE/OUD/bin/ldapsearch -h IDMHOST2.mycompany.com -p 1389 -D cn=oudadmin -b "" -s base "(objectclass=*)" supportedControl

If Oracle Unified Directory is working correctly, you see a list supportedControl entries returned.

8.4.7 Validating the Oracle Unified Directory Virtual IP Address

Validate Oracle Unified Directory virtual IP address.

To validate the IP address:

  1. On the IDMHOST1, Run the following query:

    OUD_ORACLE_INSTANCE/OUD/bin/ldapsearch -h oudinternal.mycompany.com -p 1489 -D cn=oudadmin -b "" -s base "(objectclass=*)" supportedControl
    
  2. Stop the OUD Instance on IDMHOST1.

  3. Run the same query:

    OUD_ORACLE_INSTANCE/OUD/bin/ldapsearch -h oudinternal.mycompany.com -p 1489 -D cn=oudadmin -b "" -s base "(objectclass=*)" supportedControl
    

    The query output shows that the OUD instance on IDMHOST2 is serving the request.

  4. Stop the OUD instance on IDMHOST2 and start the instance on IDMHOST1.

  5. Run the query again to show that OUD is configured correctly on both IDMHOST1 and IDMHOST2.

  6. Make sure OUD is started on IDMHOST1 and IDMHOST2.

8.5 Backing Up the Oracle Unified Directory installation

Perform a backup of the Middleware home and of Oracle Unified Directory, as described in Section 16.6, "Backing Up the Oracle IDM Enterprise Deployment."